---
title: "Auth0 Management API"
description: "Read one page of application or role metadata from your own Auth0 tenant with a customer machine-to-machine app. Explicit read scopes, no client secrets, user exports, grants or tenant changes."
---

> Documentation Index
> Fetch the complete documentation index at: https://help.tooluse.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth0 Management API

<p>Read one page of application or role metadata from your own Auth0 tenant with a customer machine-to-machine app. Explicit read scopes, no client secrets, user exports, grants or tenant changes.</p>

<details data-command-index><summary>What you can do (2)</summary>
<h2>What you can do</h2>
<p>Available commands: 2 (2 read, 0 write). Enable only the commands your application needs.</p>
<div class="nb-table-scroll"><table>
<thead>
<tr>
<th>Command</th>
<th>Effect</th>
</tr>
</thead>
<tbody><tr>
<td><a href="https://help.tooluse.net/integrations/auth0management#command-auth0management-clients-list">List clients summaries</a> — <code>auth0management.clients.list</code></td>
<td>Read</td>
</tr>
<tr>
<td><a href="https://help.tooluse.net/integrations/auth0management#command-auth0management-roles-list">List roles summaries</a> — <code>auth0management.roles.list</code></td>
<td>Read</td>
</tr>
</tbody></table>
</div>
</details>
<h2>Connect and use</h2>

<p><a href="https://www.tooluse.net/tools/integrations/auth0management">Connect and use</a></p>
<p>Open the integration&#39;s connection form to check the available credential source. The source has not been resolved for this documentation export. The instructions below apply when using your own provider account.</p>
<h2>Get your provider credentials</h2>
<p>Follow these steps for Auth0 Management API, then enter the issued values in the connection form below.</p>
<ol>
<li>In your Auth0 Dashboard, create a Machine to Machine application for this integration, authorize the Auth0 Management API and grant only read:clients and read:roles. Copy the Client ID, Client Secret and canonical tenant Domain from its Settings. In Tooluse.net Tools → Auth0 Management API → Connect with your credentials, enter those three values and save. Domain is the hostname only, such as example.us.auth0.com; URLs, custom domains and Management API Explorer test tokens are not supported. Tooluse.net derives the audience, requests only those read scopes and reuses tokens until expiry; M2M token issuance and Management API requests consume your Auth0 plan quotas. Start with page 0 and per_page 20. API output excludes client secrets and user data. Revoke the app grant or rotate its secret in Auth0 to revoke source access.</li>
</ol>
<p><a href="https://auth0.com/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production">Official credential setup</a></p>
<h2>Where to enter credentials</h2>
<p>In the integration page, sign in, choose your workspace and open Connect. If a <strong>Credentials</strong> choice is shown, select <strong>Use my credentials</strong>. Fill the following connection fields and save. Provider credentials belong in this form, never in an MCP configuration or tool input.</p>
<div class="nb-table-scroll"><table>
<thead>
<tr>
<th>Connection field</th>
<th>Requirement</th>
</tr>
</thead>
<tbody><tr>
<td>Client ID</td>
<td>Required</td>
</tr>
<tr>
<td>Client secret</td>
<td>Required</td>
</tr>
<tr>
<td>Auth0 tenant domain</td>
<td>Required</td>
</tr>
</tbody></table>
</div><p>Open API keys and create a Tooluse.net key for the enabled commands.</p>
<p>Set TOOLUSE_API_KEY in your client and use the shared MCP configuration.</p>
<p><a href="https://help.tooluse.net/clients">Configure Claude Code, Codex or Cursor once</a></p>

<h2>Permissions and results</h2>

<p>If you have more than one workspace, check the selected workspace in the connection or API-key dialog before saving. Roles, enabled commands, expiry and revocation use Tooluse.net&#39;s existing permissions. Disabling a connection or revoking a key immediately prevents new calls.</p>

<p>Send one Claude tool_use block per request. Keep the same Idempotency-Key when retrying the same request; use a new key for a new call. The response includes the shared Tooluse.net receipt and Claude tool_result. Check both HTTP status and the returned tool result before treating a call as successful.</p>

<p>Your connection&#39;s daily allowance and key permissions also apply. Adding a connection does not make a provider request.</p>

<p>Calls return the shared execution receipt and a Claude tool_result. Provider output varies by operation; consult the provider documentation for its response fields. Unconfirmed calls should be checked before retrying.</p>

<h2>Call from your client</h2>

<p>Use the shared MCP configuration. Refresh your client&#39;s tool list after saving the connection or changing key permissions, then call the returned tool name with the example input below.</p>

<p><a href="https://help.tooluse.net/clients">Configure Claude Code, Codex or Cursor once</a></p>

<h2>Discover your enabled tools</h2>

<p>List permitted tools in Claude format. Read every page using page and size (maximum 100) until all results have been received. Use the returned name, not a catalog capability identifier, in the tool_use block.</p>

<pre><code class="language-bash">curl 'https://api.tooluse.net/v1/tools' \
  -H "Authorization: Bearer $TOOLUSE_API_KEY"
</code></pre>

<p>Find this command in the tool list permitted by your key. Replace svc_FROM_YOUR_TOOL_LIST with its returned name. Use a new Idempotency-Key for each new call and retain it when retrying that same call.</p>

<h2>HTTP call</h2>

<pre><code class="language-bash">curl 'https://api.tooluse.net/v1/tool-calls' \
  -H "Authorization: Bearer $TOOLUSE_API_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: replace-with-a-new-call-id' \
  --data '{
  "type": "tool_use",
  "id": "toolu_example",
  "name": "svc_FROM_YOUR_TOOL_LIST",
  "input": {
    "query": {
      "page": 0,
      "per_page": 20
    }
  }
}'
</code></pre>

<p>Send one Claude tool_use block per request. Keep the same Idempotency-Key when retrying the same request; use a new key for a new call. The response includes the shared Tooluse.net receipt and Claude tool_result. Check both HTTP status and the returned tool result before treating a call as successful.</p>

<h2>Commands</h2>

<details id="command-auth0management-clients-list">
<summary><span>List clients summaries — <code>auth0management.<wbr>clients.<wbr>list</code></span></summary>
<p>Read one explicit zero-based page of application IDs, names, types and first-party flags; client secrets and other settings are never requested. Requires read:clients and read:roles on the customer M2M grant. per_page is 1–100; no automatic pagination or user-controlled field selection.</p>

<p>This is a read operation. Provider rate limits and data access rules still apply.</p>

<p><a href="https://www.tooluse.net/tools/integrations/auth0management?command=auth0management.clients.list">Connect and use</a></p>

<p><strong>Parameters</strong></p>

<p>Requiredness is local to the containing object. A required child is required only when its parent object or array item is provided. Alternative schemas are identified in the Constraints column; the linked full JSON Schema is authoritative.</p>

<div class="nb-table-scroll"><table>
<thead>
<tr>
<th>Parameter</th>
<th>Type</th>
<th>Required in parent</th>
<th>Description</th>
<th>Constraints</th>
</tr>
</thead>
<tbody><tr>
<td><code>query</code></td>
<td>object</td>
<td>Required</td>
<td></td>
<td><code>additionalProperties: false</code></td>
</tr>
<tr>
<td><code>query.page</code></td>
<td>integer</td>
<td>Required</td>
<td>Zero-based page number.</td>
<td><code>minimum: 0; maximum: 9007199254740991</code></td>
</tr>
<tr>
<td><code>query.per_page</code></td>
<td>integer</td>
<td>Required</td>
<td>Maximum records in this page.</td>
<td><code>minimum: 1; maximum: 100</code></td>
</tr>
</tbody></table>
</div>
<p><strong>Full JSON Schema</strong></p>

<p><a href="https://api.tooluse.net/v1/integrations/auth0management/commands/auth0management.clients.list">Full JSON Schema</a></p>

<p><strong>Example input</strong></p>

<pre><code class="language-json">{
  "query": {
    "page": 0,
    "per_page": 20
  }
}
</code></pre>

<p>At most 2 provider requests per invocation; timeout: 30 seconds.</p>

</details>
<details id="command-auth0management-roles-list">
<summary><span>List roles summaries — <code>auth0management.<wbr>roles.<wbr>list</code></span></summary>
<p>Read one explicit zero-based page of role IDs, names and descriptions; no role membership or user export. Requires read:clients and read:roles on the customer M2M grant. per_page is 1–100; no automatic pagination or user-controlled field selection.</p>

<p>This is a read operation. Provider rate limits and data access rules still apply.</p>

<p><a href="https://www.tooluse.net/tools/integrations/auth0management?command=auth0management.roles.list">Connect and use</a></p>

<p><strong>Parameters</strong></p>

<p>Requiredness is local to the containing object. A required child is required only when its parent object or array item is provided. Alternative schemas are identified in the Constraints column; the linked full JSON Schema is authoritative.</p>

<div class="nb-table-scroll"><table>
<thead>
<tr>
<th>Parameter</th>
<th>Type</th>
<th>Required in parent</th>
<th>Description</th>
<th>Constraints</th>
</tr>
</thead>
<tbody><tr>
<td><code>query</code></td>
<td>object</td>
<td>Required</td>
<td></td>
<td><code>additionalProperties: false</code></td>
</tr>
<tr>
<td><code>query.page</code></td>
<td>integer</td>
<td>Required</td>
<td>Zero-based page number.</td>
<td><code>minimum: 0; maximum: 9007199254740991</code></td>
</tr>
<tr>
<td><code>query.per_page</code></td>
<td>integer</td>
<td>Required</td>
<td>Maximum records in this page.</td>
<td><code>minimum: 1; maximum: 100</code></td>
</tr>
</tbody></table>
</div>
<p><strong>Full JSON Schema</strong></p>

<p><a href="https://api.tooluse.net/v1/integrations/auth0management/commands/auth0management.roles.list">Full JSON Schema</a></p>

<p><strong>Example input</strong></p>

<pre><code class="language-json">{
  "query": {
    "page": 0,
    "per_page": 20
  }
}
</code></pre>

<p>At most 2 provider requests per invocation; timeout: 30 seconds.</p>

</details>
<h2>Errors</h2>

<p>Check the key&#39;s expiry, revocation, workspace and allowed operations.</p>

<p>Reuse the same idempotency key only for the same request.</p>

<p>The connection or provider limit has been reached. Check the receipt before retrying.</p>

<h2>Test the connection</h2>

<p>Open the integration&#39;s commands below to inspect parameters and examples. Start with a read command for an account or resource you can access. Refresh your client&#39;s tool list, use the returned tool name, and check the execution result and usage. Provider charges and permissions still apply. Never test a write against production data without reviewing it.</p>

<p><a href="https://auth0.com/docs/api/management/v2/clients/get-clients">Official provider documentation</a></p>

Source: https://help.tooluse.net/integrations/auth0management/index.mdx